What are the correct settings for Session Cookie Management and Session Validation Management?

  • In a single store setup
  • In a multi store setup

Session Management

  • Cookie Path

  • Cookie Domain

  • Use HTTP Only

  • Cookie Restriction Mode

Session Validation Settings

  • Validate REMOTE_ADDR

  • Validate HTTP_VIA


  • Validate HTTP_USER_AGENT

  • Use SID on Frontend

I always have admin login problems. And can only get rid of it by editing the core file (comment out): /files/html/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

    // session cookie params
    $cookieParams = array(
        'lifetime' => $cookie->getLifetime(),
        'path'     => $cookie->getPath(),
        // 'domain'   => $cookie->getConfigDomain(),
        // 'secure'   => $cookie->isSecure(),
        // 'httponly' => $cookie->getHttponly()

I guess there is no "correct" setting, otherwise there won't be any options. But what is the most common setting? Do I have to have different cookie paths for different stores? What could cause my problem (can't login in Magento admin).

Thank you so much!

1 Answer 1


"I always have admin login problems" is a bit vague but here goes

Under System > Configuration > Web the settings should be as follows

enter image description here

Also set "Session Lifetime (seconds)" under System > Configuration > Admin to a high value like 7200 so you don't need to login repeatedly

  • Sander: thank you! Commented Oct 15, 2015 at 9:38
  • 1
    @Sander Mangel: I have the same config as you said but then as well I am unable to login to admin section after first log-out. I noticed in cookies that there are 2 cookies set for adminhtml and deleting one helps me to get rid of that issue but why that happens? Any idea? Commented Feb 6, 2017 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.